Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-5312

CWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUM
EPSS
40.0%
top 2.67%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Symantec Messaging Gateway
Timeline
PublishedApr 14
Latest updateMay 17

Description

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-6r8q-pc85-r7wp: Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10↗2022-05-17
▶
CVEList
CVE-2016-5312: Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10↗2017-04-14
▶

💥Exploits & PoCs

1
Exploit-DB
Symantec Messaging Gateway 10.6.1 - Directory Traversal↗2016-09-28
▶